In the field of automotive industry, the trend for higher functionality has been advancing in order to cope with the users need for safe driving. The automatic braking function, the pre-crash safety function, and the like which are becoming popular in recent years are some of the examples. In such a function, a plurality of inputs and outputs are related to each other in a complicated manner. Thus, if an abnormality occurs in the function, the function may impair the safety adversely. In view of this, the ISO 26262 Function Safety Standard for ensuring the automobile safety in terms of functions and certifying this was formulated in November 2011.
As a component that takes charge of the control of the automobile functions, a control unit configured by a microcomputer or the like can be raised. To cope with the requirement for the Function Safety Standard, sufficient safety measures must be employed in the control unit so that a sufficient decrease in the risk of failure is certified.
Patent literatures 1 and 2 describe the safety measures for the control unit.
Patent literature 1 describes incorporating, as a vehicle control unit, a control unit and another control unit that monitors the control unit.
Patent literature 2 describes monitoring a control unit by a monitoring unit which adopts the lock step technique employed among virtual CPUs. Patent literature 2 has a configuration in which an abnormality in the control unit is detected by determining the validity of the input/output information of the control unit.